Reading Wireless Air Transmitter using Arduino

[rg422]

Here is a link to the data I posted earlier, a little easier to copy and paste from the google document. The other file in that folder is the universal radio hacker file that is a baseband recording of the signal.

When I collect more samples I will put them here as well.

MH8A Transmitter Decoding

Transmitter ID: 104308 (Preamble) (Sync) (Transmitter ID) (PSI) (Battery Status) (Checksum) 364psi 0010000001101110101101001110101110000010110110000001010111 350psi 0010000001101110101101001110101110000010101111000001011111 342psi 0010000001101110101101001110101110000010101011000001011011 0...

docs.google.com

 

[rg422]

Wow, So I walked into a thrift store today and scored another transmitter of the same model as mine for $20!!

I got home and quickly recorded a sample for you all to pick over. On this document I added the new transmitter ID and data string along with known pressure. Note I was initially wrong about the PSI being divided by two, I had just missed a zero. Looks like there are 4 bit spaces between each segment of data.

MH8A Transmitter Decoding

Transmitter ID: 104308 (Preamble) (Sync) (Transmitter ID) (PSI) (Battery Status) (Checksum) 364psi 0010000001101110101101001110101110000010110110000001010111 350psi 0010000001101110101101001110101110000010101111000001011111 342psi 0010000001101110101101001110101110000010101011000001011011 0...

docs.google.com

 

[MadUKDiver]

Wow, So I walked into a thrift store today and scored another transmitter of the same model as mine for $20!!

Nice work. I've looked at the two ID values and considered quite a number of coding methods (Gray code, Block code, BCD Cipher, Huffman, 3B4B and others) but none provide the answer. All I'm left with is a straightforward symbolic substitution, possibly to ensure no long runs of 0's or 1's and thereby loss of synchronisation. This may be way off target but I'll put it here as food for thought...

Would be good if you could run one up on your power supply and map some different battery voltage values.

Keep checking the thrift store, let's hope another TX finds its way to you.

 

[rg422]

Nice work. I've looked at the two ID values and considered quite a number of coding methods (Gray code, Block code, BCD Cipher, Huffman, 3B4B and others) but none provide the answer. All I'm left with is a straightforward symbolic substitution, possibly to ensure no long runs of 0's or 1's and thereby loss of synchronisation. This may be way off target but I'll put it here as food for thought...

That's good stuff, would you mind adding the chart you posted to the google document, you should have commenting privileges'.

MH8A Transmitter Decoding

Transmitter ID: 104308 (Preamble) (Sync) (Transmitter ID) (PSI) (Battery Status) (Checksum) 364psi 0010000001101110101101001110101110000010110110000001010111 350psi 0010000001101110101101001110101110000010101111000001011111 342psi 0010000001101110101101001110101110000010101011000001011011 0...

docs.google.com

I'm looking at my battery and It's a CR2, the nominal voltage is 3.0v but does anyone know what voltage the transmitters flag as Low and subsequently critical? I should be able to quickly answer my own question with a variable power supply.

 

[tursiops]

I'm looking at my battery and It's a CR2, the nominal voltage is 3.0v but does anyone know what voltage the transmitters flag as Low and subsequently critical? I should be able to quickly answer my own question with a variable power supply.

I don't think the transmitter flags a voltage; that is done in the receiver. Shearwater flags Warning at 2.75V, and Critical at 2.5V. My OC1 only says "GOOD" or "LO" at some point.

 

[rg422]

So now that we have a suspected ID encoding format I tested how I could replay the signal, it worked. My teric was able to understand me replaying a signal I recorded from my transmitter, I just used a cheap set of earbuds and played it though my soundcard as loud as possible, the unintentionally radiated RF was able to be understood by the teric after a couple tries.

My next plan is to create a signal from scratch that has a unique ID including some of the numbers that @MadUKDiver listed as 0 occurrences. I'll then program this ID into my teric and transmit the signal, If it decodes the signal then we've got the algorithm.

Does anyone have a good method for encoding our own signal. Something quicker than me just coping and pasting pieces of the signal in an audio editing software?

 

[MadUKDiver]

My next plan is to create a signal from scratch that has a unique ID including some of the numbers that @MadUKDiver listed as 0 occurrences. I'll then program this ID into my teric and transmit the signal, If it decodes the signal then we've got the algorithm.

Awesome!

You need to find if the data is protected by a checksum so I suggest starting by changing the pressure value data only. If the change is picked up by your Teric then there is no checksum present and you can move on to evaluating the ID section. If the Teric doesn't pick it up then it's probably being rejected due to a checksum error.

The entries I gave based upon '0 occurrences' were pure guesses from the remaining unused 4 bit numbers. Again, I'd start by changing one ID digit to something we've actually seen before and if that works then you can start fishing for the missing codes.

Keep up the excellent work

 

[MadUKDiver]

Does anyone have a good method for encoding our own signal. Something quicker than me just coping and pasting pieces of the signal in an audio editing software?

I've written some Windows code to help with this...

You put in the Transmitter ID, Pressure Value and Battery (?) value and it creates the binary data stream which can be played directly through the PC speaker or saved to a .wav file.

I based the timings on the NEC 38 kHz protocol...
'Logical '0' – a 562.5µs pulse burst followed by a 562.5µs space, with a total transmit time of 1.125ms
'Logical '1' – a 562.5µs pulse burst followed by a 1.6875ms space, with a total transmit time of 2.25ms

However, this does not look right when I compare it with your trace...

When scaled to start and end at the same place on the screen the mark/space of '0' and '1' look different to me (0s appear longer and 1s shorter than the NEC values). Can you measure to any degree of accuracy the burst pulse time and space time? And also the total time start to finish for the complete transmission of a known binary sequence?

If you can give me the timings I can adjust my program and then make it available.

 

[rg422]

...
When scaled to start and end at the same place on the screen the mark/space of '0' and '1' look different to me (0s appear longer and 1s shorter than the NEC values). Can you measure to any degree of accuracy the burst pulse time and space time? And also the total time start to finish for the complete transmission of a known binary sequence?

If you can give me the timings I can adjust my program and then make it available.

I added a wav file of the recording to the folder here: MH8A TX Decoding – Google Drive

Let me know if you can extrapolate all your desired info from that file. Your programs output looks right to me, send me a wav file that it generated and I will test it out, use a known psi, id, % combination.

 

[tursiops]

I doubt the transmitter sends a percentage for the battery level. More likely it sends XY from 2.XY volts. so "87" would be 2.87 volts. I base this on the numbers/info in post #105.